CVE-2026-29045 Details
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.
A vulnerability in the Hono web application framework, prior to version 4.12.4, allowed for unauthorized access to protected static resources. This issue arose when using the 'serveStatic' middleware alongside route-based protections, such as 'app.use('/admin/*', ...)'. The problem stemmed from inconsistent URL decoding: the router utilized 'decodeURI', while 'serveStatic' employed 'decodeURIComponent'. This discrepancy enabled paths with encoded slashes (%2F) to bypass middleware protections, all while directing to the intended filesystem location. Consequently, static files could be served without triggering the necessary route-based authorizations, potentially exposing sensitive resources.
Users can upgrade to Hono version 4.12.4 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-177 | Improper Handling of URL Encoding (Hex Encoding) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hono hono | < 4.12.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 6, 2026 | Initial Analysis | [email protected] |
| Mar 4, 2026 | New CVE Received | [email protected] |